Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

2 files changed, 23 insertions, 1 deletions

diff --git a/js/src/jit-test/tests/structured-clone/bug1888727.js b/js/src/jit-test/tests/structured-clone/bug1888727.js
new file mode 100644
index 0000000000..7958781c92
--- /dev/null
+++ b/js/src/jit-test/tests/structured-clone/bug1888727.js
@@ -0,0 +1,21 @@
+function test() {
+    // Construct a structured clone of a random BigInt value.
+    const n = 0xfeeddeadbeef2dadfeeddeadbeef2dadfeeddeadbeef2dadfeeddeadbeef2dadn;
+    const s = serialize(n, [], {scope: 'DifferentProcess'});
+    assertEq(deserialize(s), n);
+
+    // Truncate it by chopping off the last 8 bytes.
+    s.clonebuffer = s.arraybuffer.slice(0, -8);
+
+    // Deserialization should now throw a catchable exception.
+    try {
+        deserialize(s);
+        // The bug was throwing an uncatchable error, so this next assertion won't
+        // be reached in either the buggy or fixed code.
+        assertEq(true, false, "should have thrown truncation error");
+    } catch (e) {
+        assertEq(e.message.includes("truncated"), true);
+    }
+}
+
+test();
diff --git a/js/src/jit-test/tests/structured-clone/tenuring.js b/js/src/jit-test/tests/structured-clone/tenuring.js
index 0fffa064fa..cec53a6956 100644
--- a/js/src/jit-test/tests/structured-clone/tenuring.js
+++ b/js/src/jit-test/tests/structured-clone/tenuring.js
@@ -1,4 +1,4 @@
-// Check that we switch to allocating in the tenure heap after the first
+// Check that we switch to allocating in the tenured heap after the first
 // nursery collection.
 
 function buildObjectTree(depth) {
@@ -82,6 +82,7 @@ function countHeapLocations(tree, objectTree, counts) {
 gczeal(0);
 gcparam('minNurseryBytes', 1024 * 1024);
 gcparam('maxNurseryBytes', 1024 * 1024);
+gcparam('semispaceNurseryEnabled', 0);
 gc();
 
 testRoundTrip(1, true, true);